interplains / zero-breach
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
interplains / zero-breach
Tracer-Cloud / opensre
Build your own AI SRE agents. The open source toolkit for the AI era.
StackStorm / st2
StackStorm (aka "IFTTT for Ops") is event-driven automation for auto-remediation, incident responses, troubleshooting, deployments, and more for DevOps and SREs. Includes rules engine, workflow, 160 integration packs with 6000+ actions (see https://exchange.stackstorm.org) and ChatOps. Installer at https://docs.stackstorm.com/install/index.html
google / grr
GRR Rapid Response: remote live forensics for incident response
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
volatilityfoundation / volatility3
Volatility 3.0 development
TracecatHQ / tracecat
Open-source security automation platform for teams and AI agents
HolmesGPT / holmesgpt
SRE Agent - CNCF Sandbox Project
beenuar / AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
django-helpdesk / django-helpdesk
A Django application to manage tickets for an internal helpdesk. Formerly known as Jutda Helpdesk.
ahmedkhlief / APT-Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
CIRCL / AIL-framework
AIL framework - Analysis Information Leak framework. Project moved to https://github.com/ail-project
mrwadams / attackgen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.
cisagov / untitledgoosetool
Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
certsocietegenerale / fame
FAME Automates Malware Evaluation
MORTEN-BUUR / nordef-matrix-open-control
NORDEF Matrix Open Control: model-independent AI safety belt with 0/1/2 decisions, Ed25519 root gate, replay protection, evidence chain, and incident-pattern eval bank
stanfrbd / cyberbro
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
Azr43lKn1ght / DFIR-LABS
DFIR LABS - A compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.
CybercentreCanada / assemblyline
Assemblyline 4: File triage and malware analysis
google / mcp-security
—
anthropics / oncall-kit
Starter kit for a Claude-assisted on-call: mines your incident history into triage playbooks, sets up through human-approved gates, and runs read-only in your Slack channel — humans deploy every fix.
thiientv / godmode
Production-grade Agent Skills for AI coding agents—composable workflows for planning, TDD, debugging, review, UI/UX, releases, incidents, and evals.
RomanZhukov9 / Crypto-Recovery-Tool
Python-based cryptocurrency wallet forensics suite supporting 40+ wallet types on Windows, Linux, and macOS. Features encrypted vault analysis, wallet detection, seed recovery, multi-chain address derivation, threaded processing, and TXT/CSV/JSON export. Designed for security research, compliance, incident response, and blockchain investigations.
shanananana / deepticket
An AI troubleshooting workbench for internal systems: it integrates ticketing and alerting systems via HTTP APIs and webhooks, connects code, logs, configurations, and agents, and provides a web-based self-service analysis interface for product, operations, and customer support teams.
elsechord / CyberGuard
Evidence-driven autonomous SOC team on AgentTeams: hash-bound approvals, HMAC audit chain, rollback and reproducible attack scenarios — auditable governance primitives for agent infrastructure.
nickname21kmr / gameops-investigator
Evidence-first game operations incident investigation agent with read-only MCP tools and reproducible evaluations.
incident-io / sdk-python
Python SDK for the incident.io API
EmadAbedini / Dumplyzer
Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.
yankywilson / kyber-ransomware-analysis
Full teardown of the Kyber ransomware Windows encryptor. Six corrections to public reporting, each independently verifiable. Includes analysis tooling, detection content, and incident response guidance.
prox0959 / CyberCodex
Autonomous 23-Source Zero-Cost OSINT, Binary Image Forensics (EXIF/GPS/Stego), Data Breach/Leak & Threat Intelligence Engine in Pure Python
sunny-crypto444 / ai-incident-response-agent
—